CRITICAL✓ PATCH🇬🇧 English

CVE-2019-17571

CVSS 9.8v3.1pub. 2019-12-20upd. 2026-05-28

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.

oryginał EN

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache Bookkeeper
APP
Apache
< 4.14.3
Apache Log4j
APP
Apache
≤ 1.2.17
Canonical Ubuntu
OS
Canonical
18.04
Debian
OS
Debian
10.08.09.0
Netapp Oncommand System Manager
APP
Netapp
3.0 – 3.1.3
Netapp Oncommand Workflow Automation
APP
Netapp
wszystkie wersje
Opensuse Leap
OS
Opensuse
15.1
Oracle Application Testing Suite
APP
Oracle
13.3.0.1
Oracle Communications Network Integrity
APP
Oracle
7.3.2 – 7.3.6
Oracle Endeca Information Discovery Studio
APP
Oracle
3.2.0
Oracle Financial Services Lending And Leasing
APP
Oracle
12.5.014.1.0 – 14.8.0
Oracle MySQL Enterprise Monitor
APP
Oracle
≤ 8.0.29
Oracle Primavera Gateway
APP
Oracle
17.12.0 – 17.12.716.2 – 16.2.11
Oracle Rapid Planning
APP
Oracle
12.112.2
Oracle Retail Extract Transform And Load
APP
Oracle
19.0
Oracle Retail Service Backbone
APP
Oracle
14.115.016.0
Oracle Weblogic Server
APP
Oracle
10.3.6.0.012.1.3.0.012.2.1.3.012.2.1.4.014.1.1.0.0